From 5826af62679c982cd080805bb3505ceec2079da9 Mon Sep 17 00:00:00 2001
From: Yasunobu <42543015+P4suta@users.noreply.github.com>
Date: Tue, 4 Aug 2026 20:47:34 +0900
Subject: [PATCH] ci: exercise the release path on every pull request

Every defect found in the release path so far was invisible to CI, because CI
tests the crate and nothing runs the release. The list, all from real failed
releases: an action missing from the repository allowlist, and then two more
that release-plz itself calls; a release-plz configuration that disagreed with
a manifest; a runner that cannot build the crate `cargo publish` verifies; a
`release_always` setting that made the crate permanently unreleasable. Each
one was found by attempting a release and reading the failure.

Run the real release action with `dry_run`. It downloads the same actions,
including the ones release-plz calls internally, parses the same
configuration, resolves the same versions, and performs the same `cargo
publish` verification build. It uploads nothing.

That covers the whole class: an unlisted action fails when it is downloaded, a
configuration conflict fails when it is parsed, and a runner that cannot build
the crate fails in the verification build -- all on the pull request instead of
during a release.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 32 +++++++++++++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 36c7374..30f5b89 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -120,10 +120,40 @@ jobs:
       - run: python -m pip install "reuse[charset-normalizer]==6.2.0"
       - run: just release-candidate
 
+  # Everything above tests the crate. Nothing above touches the release path,
+  # which is why every defect in it so far only appeared during a release:
+  # an action missing from the repository allowlist, a release-plz
+  # configuration that disagreed with a manifest, a runner that cannot build
+  # the crate `cargo publish` verifies. This job runs the real release action
+  # with `dry_run`, so it downloads the same actions (including the ones
+  # release-plz itself calls), parses the same configuration, and performs the
+  # same publish verification build -- without uploading anything.
+  release-dry-run:
+    name: Release dry run
+    runs-on: windows-2022
+    timeout-minutes: 45
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9  # v1
+        with:
+          toolchain: stable
+      - uses: release-plz/action@2eb1d8bcb770b4c48ccfaad919734b38b51958c9  # v0.5.131
+        with:
+          command: release
+          version: 0.3.160
+          dry_run: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   ci-required:
     name: CI required
     if: always()
-    needs: [hygiene, test, i686-smoke, linux, coverage, package]
+    needs: [hygiene, test, i686-smoke, linux, coverage, package, release-dry-run]
     runs-on: ubuntu-latest
     steps:
       - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')